Tags: routing

11/25/12

The backstory is that I've been working in a primarily Sun shop, and one of the things we've been doing is running Solaris 10 on large boxes, such as T2000's, T5120's, M4000's and cutting them up with Solaris zones/containers with the global native into a management vlan and tagging appropriate vlans for the zones, and the zones have their own default route specification so all has been great.

ipf on the global so the zones can't tamper with their own firewalls, and on some of the 'zone' servers using:

/usr/sbin/ndd -set /dev/ip ip_restrict_interzone_loopback 1

The zones remain isolated from each other. Or it avoids problems of short circuiting (asymetric routing + wrong IP)....because some of the zones are behind the F5.

For years, we've tossed around the idea of introducing FreeBSD into our datacenter, and finally one of our customers decided that while they really like the containers/zones and ZFS, the cost of replacing their aging Sun server would be better done by replacing it with a FreeBSD server. While they own the hardware, and it resides at their facility...we provide the system administration support. But, this opened the door to having FreeBSD on our work site. I was in the process of replacing my aging Sun Ultra 20 with an Optiplex 990...which originally I was looking at install Ubuntu on, but instead I went with FreeBSD 9.0 (though the effort in getting the Desktop working on it, and recreating my Sun desktop/work environment on it...made me question if that was really the right way to go. But, I got it working.) And, it helps me try some of the things before doing them on the customer's server (which is headless in a closet [well, they have a monitor & keyboard for console access], so all the desktop stuff was for my benefit...it paved the way to me getting a working FreeBSD desktop at home .... though I may end up with a different system for my main desktop at home and have the FreeBSD machine go headless with my other FreeBSD servers....unless there's some way to easily share between the two....switching doesn't qualify.)

So, in needing to deploy some new internal services (such as monitoring) and not really wanting to go through the major process of find all the bits and pieces and creating packages under our CM system for Solaris. Its quite the pain building each and every perl module as separate CM packages, instead of having some system that automatically builds and installs (or makes packages) for you...ala ports or CPAN. I've done package install requests that start out as install one package, and end up building 100 or so packages instead.

I had contemplated sneaking Ubuntu in since I run the same monitoring servers on an Ubuntu server at home, but the work to incorporate Ubuntu into our configuration management infrastructure got sidelined by FreeBSD. And, there's no decision on whether Ubuntu will come into play (though the high cost of RedHat licenses to just get patches...for systems that are rarely patched....is making Ubuntu look attractive.)

Anyways things led to me starting work on pxe boot installing Proliant DL380s with FreeBSD 9.0 and creating 'jail' servers to work like our 'zone' servers.

Now instead of subjecting some poor random forum to a long rambling thought, I will try to consolidate those things into this blog where they can be more easily ignored profess to be collected thoughts from my mind.